I agree with pushing elliptic curves, but I don't like the way they get there.<p>First, some historical corrections: the first L[1/2] algorithm for either factorization or discrete log was CFRAC, presented by Brillhart and Morrison in 1974 [1]. This was the first time a L[1/2] algorithm was <i>formalized</i>: descriptions of this basic method go back to the 1930s and the work of Lehmer and Powers [2] and Kraitchik. I presume 1979 refers to Adleman's subexponential discrete log paper [3].<p>1984 saw Coppersmith's L[1/3] algorithm for discrete logarithms in GF(2^n) [4]. The trick was that, in GF(2^n), the freshman's dream is true: A^2 + B^2 = (A + B)^2. This makes the polynomials we need to check for smoothness much smaller (for appropriately chosen polynomials), so much so that the overall asymptotic running time decreases.<p>Then in 1990 the number field sieve [5] appears for factorization, also at L[1/3]. You'd think that this had something to do with 1984's Coppersmith, right? Wrong. The number field sieve came from independent efforts, started by ElGamal [6], Coppersmith et al [7], and Pollard [8].<p>So you can see that Coppersmith's GF(2^n) trick never factored into the number field sieve. The function field sieve [9] is, however, a continuation of Coppersmith's effort in fields of small characteristic (e.g., GF(2^n), GF(3^n), etc). There are many improvements over the FFS that I'm going to gloss over now. More recently, this work has been continued by Joux and friends [10,11,12,13], who have basically annihilated sieving for some specific fields, and most of the time is spent on individual logs. Note that even for small characteristic, where such algorithms apply, well-chosen fields will still be fairly secure: for example GF(2^2039) still has about 77 bits of security, similar to RSA-1024.<p>There is no reason to believe that the tricks used by Joux carry over to the integers or GF(p), as the 1984 trick never carried over either. We might see an improvement to integer factorization soon, but I seriously doubt these tricks will be in its origin. My <i>guess</i> is that RSA will get an long overdrawn death like Rivest's other brainchild, RC4.<p>There are plenty of reasons to prefer elliptic curves over finite fields. Elliptic curves are smaller, faster, safer, and shinier. But like the finite field case, there are also classes of curves that are cheaper to attack. Did you know that <i>all</i> elliptic curves over GF(2^n) can be solved in subexponential time [14]? Let's move to NTRU! This kind of scare tactics is unproductive.<p>[1] <a href="http://www.ams.org/journals/mcom/1975-29-129/S0025-5718-1975-0371800-5/S0025-5718-1975-0371800-5.pdf" rel="nofollow">http://www.ams.org/journals/mcom/1975-29-129/S0025-5718-1975...</a><p>[2] <a href="http://www.ams.org/journals/bull/1931-37-10/S0002-9904-1931-05271-X/S0002-9904-1931-05271-X.pdf" rel="nofollow">http://www.ams.org/journals/bull/1931-37-10/S0002-9904-1931-...</a><p>[3] <a href="http://cr.yp.to/bib/1979/adleman.html" rel="nofollow">http://cr.yp.to/bib/1979/adleman.html</a><p>[4] <a href="http://www.enseignement.polytechnique.fr/profs/informatique/Francois.Morain/Master1/Crypto/projects/Coppersmith84.pdf" rel="nofollow">http://www.enseignement.polytechnique.fr/profs/informatique/...</a><p>[5] <a href="http://www.iai.uni-bonn.de/~adrian/nfs/lenstra90number.pdf" rel="nofollow">http://www.iai.uni-bonn.de/~adrian/nfs/lenstra90number.pdf</a><p>[6] <a href="http://link.springer.com/chapter/10.1007%2F978-1-4684-4730-9_22" rel="nofollow">http://link.springer.com/chapter/10.1007%2F978-1-4684-4730-9...</a><p>[7] <a href="http://cr.yp.to/bib/1986/coppersmith.html" rel="nofollow">http://cr.yp.to/bib/1986/coppersmith.html</a><p>[8] <a href="http://link.springer.com/content/pdf/10.1007/BFb0091536.pdf" rel="nofollow">http://link.springer.com/content/pdf/10.1007/BFb0091536.pdf</a><p>[9] <a href="http://cr.yp.to/bib/1994/adleman-ffs.html" rel="nofollow">http://cr.yp.to/bib/1994/adleman-ffs.html</a><p>[10] <a href="http://eprint.iacr.org/2012/720" rel="nofollow">http://eprint.iacr.org/2012/720</a><p>[11] <a href="http://eprint.iacr.org/2013/074" rel="nofollow">http://eprint.iacr.org/2013/074</a><p>[12] <a href="http://eprint.iacr.org/2013/095" rel="nofollow">http://eprint.iacr.org/2013/095</a><p>[13] <a href="http://eprint.iacr.org/2013/400" rel="nofollow">http://eprint.iacr.org/2013/400</a><p>[14] <a href="http://eprint.iacr.org/2012/146" rel="nofollow">http://eprint.iacr.org/2012/146</a>